NAVAL 

POSTGRADUATE 

SCHOOL 

MONTEREY,  CALIFORNIA 


MBA  PROFESSIONAL  REPORT 


Enterprise  Risk  Management  Solutions: 
A  Case  Study 


By:  Douglas  C.  Hays 

June  2008 

Advisors:  Joseph  G.  San  Miguel 

Don  Summers 


Approved  for  public  release;  distribution  is  unlimited. 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


REPORT  DOCUMENTATION  PAGE 


Form  Approved  OMB  No.  0704-0188 

Public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instruction, 
searching  existing  data  sources,  gathering  and  maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send 
comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information,  including  suggestions  for  reducing  this  burden,  to 
Washington  headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington,  VA 
22202-4302,  and  to  the  Office  of  Management  and  Budget,  Paperwork  Reduction  Project  (0704-0188)  Washington  DC  20503. 

I.  AGENCY  USE  ONLY  (Leave  blank)  2.  REPORT  DATE  3.  REPORT  TYPE  AND  DATES  COVERED 

June  2008  MBA  Professional  Report 

4.  TITLE  AND  SUBTITLE  Enterprise  Risk  Management  Solutions:  A  Case  5.  FUNDING  NUMBERS 
Study 

6.  AUTHOR(S)  Douglas  C.  Hays 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES)  8.  PERFORMING  ORGANIZATION 

Naval  Postgraduate  School  REPORT  NUMBER 

9.  SPONSORING  /MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES)  10.  SPONSORING/MONITORING 
N/A  AGENCY  REPORT  NUMBER 

II.  SUPPLEMENTARY  NOTES  The  views  expressed  in  this  thesis  are  those  of  the  author  and  do  not  reflect  the  official  policy 
or  position  of  the  Department  of  Defense  or  the  U.S.  Government. 

12a.  DISTRIBUTION  /  AVAILABILITY  STATEMENT  12b.  DISTRIBUTION  CODE 

Approved  for  public  release;  distribution  is  unlimited _ 

13.  ABSTRACT  (maximum  200  words) 

In  recent  years,  financial  risk  management  has  received  increasing  attention  from  managers  in  both 
private  and  public  enterprises,  regulatory  agencies,  and  elected  officials.  The  purpose  of  this  research 
is  to  prepare  a  case  study  of  a  firm  that  seeks  to  provide  a  risk  management  solution  for  organizations. 

The  case  study  resulted  in  a  business  plan,  which  was  strategic  in  scope  with  a  significant  portion  of  the 
analysis  concentrating  on  the  firm’s  competitive  positioning  within  the  industry  and  an  assessment  of 
the  direction  the  firm  should  move  to  achieve  future  success.  This  case  study  provides  the  sponsoring 
firm’s  management  team  with  a  comprehensive,  realistic,  and  unbiased  strategic  analysis  with  several 
unique  recommended  courses  of  action  for  its  future  operating,  management  and  financial  decisions. 

14.  SUBJECT  TERMS  Financial  Risk  Management,  Strategic  Analysis,  Porter’s  Five  Forces  15.  NUMBER  OF 

PAGES 

_ 55 _ 

16.  PRICE  CODE 

17.  SECURITY  18.  SECURITY  19.  SECURITY  20.  LIMITATION  OF 

CLASSIFICATION  OF  CLASSIFICATION  OF  THIS  CLASSIFICATION  OF  ABSTRACT 

REPORT  PAGE  ABSTRACT 

Unclassified  Unclassified  Unclassified  UU 

NSN  7540-0 1  -280-5500  Standard  Form  298  (Rev.  2-89) 

Prescribed  by  ANSI  Std.  239-18 


1 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


11 


Approved  for  public  release;  distribution  is  unlimited 


ENTERPRISE  RISK  MANAGEMENT  SOLUTIONS: 

A  CASE  STUDY 

Douglas  C.  Hays,  Major,  United  States  Army 
Submitted  in  partial  fulfillment  of  the  requirements  for  the  degree  of 

MASTER  OF  BUSINESS  ADMINISTRATION 

from  the 

NAVAL  POSTGRADUATE  SCHOOL 
June  2008 


Authors:  _ 

Douglas  C.  Hays 


Approved  by:  _ 

Joseph  San  Miguel,  Lead  Advisor 


Don  Summers,  Support  Advisor 


Robert  N.  Beck,  Dean 

Graduate  School  of  Business  and  Public  Policy 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


IV 


ENTERPRISE  RISK  MANAGEMENT  SOLUTIONS: 

A  CASE  STUDY 

ABSTRACT 

In  recent  years,  financial  risk  management  has  received  increasing  attention  from 
managers  in  both  private  and  public  enterprises,  regulatory  agencies,  and  elected 
officials.  The  purpose  of  this  research  is  to  prepare  a  case  study  of  a  firm  that  seeks  to 
provide  a  risk  management  solution  for  organizations.  The  case  study  resulted  in  a 
business  plan,  which  was  strategic  in  scope  with  a  significant  portion  of  the  analysis 
concentrating  on  the  firm’s  competitive  positioning  within  the  industry  and  an  assessment 
of  the  direction  the  firm  should  move  to  achieve  future  success.  This  case  study  provides 
the  sponsoring  firm’s  management  team  with  a  comprehensive,  realistic,  and  unbiased 
strategic  analysis  with  several  unique  recommended  courses  of  action  for  its  future 
operating,  management  and  financial  decisions. 


v 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


vi 


TABLE  OF  CONTENTS 


EXECUTIVE  SUMMARY . 1 

I.  BUSINESS  HISTORY,  BACKGROUND,  AND  OBJECTIVES . 5 

II.  RISK  MANAGEMENT  BUSINESS  ENVIRONMENT . 11 

III.  STRATEGIC  ANALYSIS . 17 

A.  FIVE  FORCES  ANALYSIS . 18 

B.  TO  PATENT  OR  NOT? . 19 

IV.  MARKETING . 31 

A.  MARKET  STRATEGY . 31 

B  BUSINESS  OBJECTIVES . 31 

C.  TARGET  MARKETS . 33 

D.  POSITIONING . 34 

E.  STRATEGIES . 34 

F.  MARKETING  MIX . 37 

G.  MARKETING  RESEARCH . 38 

H.  MANAGEMENT  CONTROLS . 38 

V.  CONCLUSIONS . 39 

LIST  OF  REFERENCES . 41 

INITIAL  DISTRIBUTION  LIST . 43 


vii 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


LIST  OF  FIGURES 


Figure  1.  Intersections  represent  processes  affected  by  risk . 7 

Figure  2.  Individuals  or  departments  affected  by  particular  processes . 8 


IX 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


x 


EXECUTIVE  SUMMARY 


According  to  data  provided  by  the  Securities  and  Exchange  Commission  (SEC) 
from  1999  to  2002,  the  number  of  accounting  fraud  cases  investigated  involving  major 
U.S.  corporations  jumped  41  percent.  Some  of  the  more  high-profile  corporations 
investigated  by  the  SEC  included  Enron,  HealthSouth  and  WorldCom  [1].  There  were 
several  reasons  for  the  increase  in  SEC  investigations;  however,  the  biggest  was  improper 
reporting  of  quarterly  and  annual  earning  statements.  Companies  were  able  to  mislead 
investors,  Wall  Street,  and  employees  by  manipulating  revenues  though  questionable 
accounting  and  auditing  procedures. 

Because  of  this  alanning  trend,  the  government  imposed  more  stringent 
accounting  and  auditing  requirements  on  major  corporations,  hoping  to  avoid  future 
catastrophes  such  as  Enron.  Currently,  the  regulation  that  has  garnered  the  most  attention 
is  the  Sarbanes-Oxley  Act  of  2002;  with  sections  302  and  404  of  the  act  providing  the 
background  and  rationale  for  this  case  study.  Section  302  of  the  Act  requires  the  Chief 
Executive  Officer  (CEO)  and  Chief  Financial  Officer  (CFO)  of  each  issuer  to  prepare  a 
statement  to  accompany  the  audit  report  that  certifies  the  "appropriateness  of  the  financial 
statements  and  disclosures  contained  in  the  periodic  report,  and  that  those  financial 
statements  and  disclosures  fairly  present,  in  all  material  respects,  the  operations  and 
financial  condition  of  the  issuer."  A  violation  of  this  section  must  be  known  and 
intentional  to  give  rise  to  liability.  Section  404  requires  each  annual  report  of  an  issuer  to 
contain  an  "internal  control  report,"  which  shall:  1.  State  the  responsibility  of 
management  for  establishing  and  maintaining  an  adequate  internal  control  structure  and 
procedures  for  financial  reporting;  and  2.  Contain  an  assessment,  as  of  the  end  of  the 
issuer's  fiscal  year,  of  the  effectiveness  of  the  internal  control  structure  and  procedures  of 
the  issuer  for  financial  reporting.  Each  issuer's  auditor  shall  attest  to,  and  report  on,  the 
assessment  made  by  the  management  of  the  issuer.  An  attestation  made  under  this  section 
shall  be  in  accordance  with  standards  for  attestation  engagements  issued  or  adopted  by 
the  Public  Company  Accounting  Oversight  Board  (PCAOB  or  the  Board).  An  attestation 
engagement  shall  not  be  the  subject  of  a  separate  engagement  [2]. 
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Because  CEOs  and  CFOs  are  now  legally  bound  to  demonstrate  that  they 
understand  the  contents  of  their  earnings  report  and  are  required  to  implement  and 
monitor  an  internal  control  program  within  their  organizations,  the  need  for  financial  risk 
management  software  has  become  a  necessity.  There  are  several  reasons  for  financial 
risk  software,  but  the  primary  reasons  have  to  do  with  the  efficiency  and  volume  of 
accounting  procedures  and  requirements  that  must  now  be  managed.  Although  major 
corporations  followed  accounting  and  auditing  procedures  before  2002,  many  of  the 
requirements  were  accomplished  through  the  use  of  spreadsheets  and  paper  and  pencil 
techniques  with  no  requirement  to  demonstrate  unifonnity  or  specific  regulatory 
adherence  within  a  particular  industry.  Often,  accounting  and  auditing  records  provided 
nothing  other  than  a  means  to  demonstrate  awareness  of  a  specific  requirement  by  an 
organization  and  cursory  proof  that  a  control  was  in  place  to  monitor  and  execute  a 
requirement.  Therefore,  if  the  possibility  existed  that  recording  and  reporting  procedures 
had  been  ignored  or  manipulated  by  an  organization,  there  was  really  no  way  to  be  100 
percent  confident  that  a  law  had  been  broken. 

Examining  hundreds  of  accounting  and  auditing  files  and  finding  compliance  to  a 
particular  regulation  for  an  external  auditor  was  not  practical,  efficient  or  realistic  with 
the  advent  of  Sarbanes-Oxley.  Therefore,  it  was  in  the  best  interest  of  corporations  to 
find  an  efficient  method  to  demonstrate  financial  compliance  while  at  the  same  time 
providing  company  executives  the  peace  of  mind  that  their  company’s  accounting 
practices  were  being  properly  executed.  A  majority  of  large  corporations  are  now 
procuring  financial  risk  management  software  as  an  efficient  method  to  demonstrate 
financial  compliance.  There  are  currently  several  risk  management  software  packages 
available.  However,  due  to  the  relative  young  age  of  the  industry,  there  are  numerous 
opportunities  for  financial  risk  management  software  developers  to  thrive. 

Albert  Jackson,  formerly  a  risk  management  executive  for  American  Financial 
Corporation  (AFC)  (a  large  financial  services  company),  contacted  the  Naval 
Postgraduate  School  in  Monterey,  California,  to  seek  assistance  in  analyzing  and 
developing  a  strategy  for  a  financial  risk  management  software  product  that  he  and  his 
wife  had  been  developing  for  the  past  ten  years.  Although  Albert  considered  his  work 

2 


with  the  software  as  part  of  a  small  business  operation  he  had  yet  to  make  the  type  of 
commitment  to  his  business  that  would  allow  it  to  flourish  if  he  were  to  devote  100 
percent  of  his  time.  What  Albert  hoped  to  gain  through  the  outside  assistance  was  an 
assessment  of  where  devotion  of  100  percent  of  his  time  would  lead  and  the  strategies  he 
should  use  to  build  his  business  if  he  was  willing  to  make  such  a  commitment.  In 
response  to  his  request  for  an  external,  independent  appraisal  this  case  study  was 
undertaken. 
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I. 


BUSINESS  HISTORY,  BACKGROUND,  AND  OBJECTIVES 


In  an  effort  to  assist  American  Financial  Corporation  (AFC)  manage  financial  risk 
in  their  retail  and  credit  card  departments,  Albert,  a  risk  management  executive  for  the 
company,  developed  a  technology  solution.  His  goal  was  to  develop  a  tool  that  was 
functional  at  all  levels.  To  assist  him  in  his  endeavor,  Albert  enlisted  the  assistance  of 
Scott  Thomas,  an  associate  and  software  engineer.  The  primary  objective  was  to  provide 
management  with  the  capability  to  supervise,  control  and  monitor  financial  risk 
throughout  the  company  while  allowing  employees  to  execute  tasks  identified  by  the 
technology  at  the  user  level  (a  top-down  risk  management  method).  Those  tasks 
executed  by  the  employees  would  be  defined  as  the  risk  mitigating  controls  identified  by 
AFC’s  financial  management  team  or  those  controls  independently  identified  and 
executed  by  the  software. 

An  example  of  one  such  task  follows:  Suppose  there  is  a  business  risk  assumed  by 
several  units/departments  throughout  an  organization  associated  with  noncompliance 
with  the  USA  Patriot  Act.  The  President  signed  the  USA  Patriot  Act  into  law  on  October 
26,  2001,  making  a  number  of  amendments  to  the  anti-money  laundering  provisions  of  the 
Bank  Secrecy  Act  and  the  Money  Laundering  Control  Act  of  1986.  The  amendments  were 
intended  to  make  it  easier  to  detect,  prevent,  and  prosecute  international  money  laundering 
activities  and  the  financing  of  terrorism  [3],  Albert  developed  software  that  would  enable 
an  organization  to  monitor  and  control  the  task  of  ensuring  that  no  unlawful  production  of 
correspondence  accounts  were  established  by  potential  or  known  terrorists  to  facilitate 
money  laundering  for  use  in  unlawful  activities.  Of  significance  is  the  software’s  ability 
to  execute  implemented  controls,  if  desired,  by  an  institution’s  management  team. 
Throughout  the  industry,  this  capability  is  referred  to  as  “artificial  intelligence.”  This 
issue  will  be  addressed  in  length  later  in  the  analysis,  but  is  considered  the  genesis  of 
Albert’s  rationale  for  subsequently  deciding  to  leave  employment  with  AFC  and  attempt 
to  market  the  software  as  an  independent  business  owner. 

Albert  and  Scott  accomplished  their  desired  end  state  of  assisting  AFC  in 

effectively  managing  risk  in  their  credit  and  retail  departments.  Once  implemented,  the 
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software  enabled  the  company  to  streamline  processes  in  both  departments,  reduce 
financial  burdens  associated  with  the  programs,  and  implement,  monitor  and  execute  a  set 
of  controls  to  ensure  employees  throughout  the  organization  were  in  compliance  with 
goals  established  by  management. 

Initially  the  software  was  developed  to  help  manage  risk  in  only  AFC’s  credit  and 
retail  departments.  However,  after  the  crisis  that  occurred  in  financial  markets  at  the  turn 
of  the  century  (as  a  result  of  scandals  that  occurred  at  companies  such  as  Enron,  Quest 
and  HealthSouth),  Albert  and  Scott  began  tailoring  the  software  to  meet  risk  management 
and  control  requirements  of  financial  institutions  outside  AFC,  along  with  non-financial 
organizations  required  to  publicly  report  quarterly  earnings. 

At  the  time,  Albert’s  research  indicated  a  saturation  of  similar  software 
throughout  the  industry.  Therefore,  he  knew  “differentiation”  was  the  key  to  success.  As 
a  result,  he  decided  to  focus  on  risk  management  from  a  “process  and  control”  execution 
perspective  rather  than  the  single  unit  and  control  recognition  approach  used  to  manage 
risk  by  many  of  his  competitors.  Albert  believed  that  by  examining  each  individual 
process  executed  by  an  organization,  determining  what  units  within  an  organization  were 
involved  in  that  process,  and  then  attaching  risk  to  each  of  those  entities  simultaneously; 
management’s  ability  to  control  risk  was  enhanced  exponentially. 

Where  Albert  hoped  to  differentiate  his  approach  from  competitors  was  by 
developing  a  tool  that  not  only  identified  and  required  users  to  manually  execute  controls, 
but  development  of  a  tool  that  actually  executed  those  controls  identified  by  Enterprise 
Risk  Management  Solutions  (ERMS)  if  the  company  purchasing  his  product  wished  to 
have  those  capabilities  available.  Figures  1  and  2  demonstrate  this  concept  in  three 
dimensions.  Included  in  the  figures  are  the  individual  departments  and  processes  that 
operate  within  an  organization  and  several  examples  of  risk/regulatory  requirements  that 
a  financial  organization  must  manage  on  a  day-to-day  basis. 

The  risks  referred  to  are  in  no  way  all-inclusive  but  represent  a  sample  of  those 
risks  with  which  the  majority  of  financial  institutions  must  be  in  compliance  to  satisfy 
legal  or  regulatory  guidelines.  For  example,  one  of  the  more  recognizable  requirements 
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include  Sarbanes/Oxley,  an  act  passed  by  U.S.  Congress  to  protect  investors  from  the 
possibility  of  fraudulent  accounting  activities  by  establishing  accountability  mechanisms 
at  the  executive  levels  of  registered  public  companies.  Another  is  the  Fair  Lending 
Regulations,  which  prohibit  the  use  of  discriminatory  appraisals  and  require  the 
preparation  of  written  loan  underwriting  standards,  the  collection  of  monitoring 
information  and  the  maintenance  of  loan  application  registers  [4],  In  order  to  understand 
Albert’s  ideas  on  risk  management  monitoring  and  control,  imagine  that  the  Figures  1 
and  2  are  constructed  as  a  box. 

In  Figure  1,  the  areas  that  intersect  represent  a  process  within  the  organization  that 
is  affected  by  a  risk.  Analysis  of  Figure  2  demonstrates  an  individual  unit/department 
that  is  affected  by  a  particular  business  process.  By  bringing  together  the  process  with 
the  risk  and  drilling  down  one  more  level  to  the  business  unit  (i.e.,  department), 
management  is  able  to  determine  what  units  involved  in  the  execution  of  a  particular  task 
actually  assume  risk  during  the  execution  phase  of  an  individual  task. 


Figure  1.  Intersections  represent  processes  affected  by  risk.  From  [5] 
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Figure  2.  Individuals  or  departments  affected  by  particular  processes.  From  [5] 


For  example,  a  financial  institution  that  has  a  process  for  opening  new  deposit 
accounts  is  exposed  to  Rank  Secrecy  Act  risks  that  a  credit  card  bank  may  not  be  exposed 
to,  as  it  does  not  have  such  a  process.  Figure  1  shows  how  Business  Process  1  intersects 
with  TILA/Reg  Z  Operational,  Reputation,  and  Strategic  Risk.  Conversely, 
BSA/PATRIOT  risks  intersect  with  Business  Processes  2  and  3.  [5]  Similarly,  there  is 
another  natural  intersection  between  a  process  and  a  business  unit.  Business  units  and 
departments  exist  to  efficiently  and  effectively  serve  the  business  process.  Figure  2 
shows  how  Business  Process  1  intersects  with  Departments  1,  2,  3,  5,  and  10. 
Conversely,  Department  1  intersects  with  Business  Processes  1  and  5.  Once  the  natural 
intersections  have  been  identified  and  determined  across  processes  and  units,  ERMS’s 
unique  software  is  able  to  execute,  analyze  and  monitor  control  procedures  through  the 
program’s  artificial  intelligence  capabilities.  According  to  Albert,  other  financial  risk 
management  software  available  on  the  market  only  identifies  and  determines  risks  across 
processes  and  units.  The  execution  of  controls  must  be  completed  by  humans. 
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As  Albert  and  Scott  worked  the  software  development  phase  of  the  business, 
Albert’s  wife  Kristine  began  to  build  a  foundation  to  market,  distribute,  and  manage  the 
risk  management  software.  First,  she  detennined  a  name  for  their  business,  Enterprise 
Risk  Management  Solutions  (ERMS)  Inc.  This  is  also  the  name  that  will  be  used 
throughout  this  project  when  referencing  the  software.  Next,  she  began  adding  critical 
personnel  to  the  management  side  of  the  company.  She  hired  Tom  Fisher  as  an 
operations  manager,  Larry  Wilson  and  Jessica  Klein  as  an  installation  and  training  team, 
and  Maggie  Singer  as  a  business  consultant. 

Currently,  AFC  is  the  only  financial  institution  using  ERMS,  although  they  are 
discussing  the  potential  sale  of  ERMS  to  a  bank  in  Omaha,  a  casino  in  Nevada  and  an 
accounting  consulting  firm  in  Boston.  The  selling  price  for  the  software  is  currently  set 
at  $65,000  for  the  Process  Module  and  $65,000  for  the  Control  Module.  Additionally, 
there  is  an  annual  licensing  fee  of  $65,000  and  an  installation  fee  of  $5,000  added  to  the 
initial  price.  Maintenance  fees  include  technical  support  charged  at  $150  an  hour, 
training  at  $640  a  day  and  consulting  (included  in  the  consulting  fees  are  tasks  such  as 
methods  that  can  further  optimize  ERMS’s  capabilities)  at  $225  an  hour.  According  to 
Albert,  the  selection  of  the  prices  was  based  on  an  industry  price  of  $250,000.  He 
believed  the  overhead  required  to  produce  the  software  for  a  single  organization  was  such 
that  he  could  price  his  product  significantly  lower  than  competitors  and  enable  ERMS  to 
compete  globally  if  he  ever  decided  make  the  software  available  on  the  open  market. 
Other  than  a  limited  requirement  to  adapt  specific  software  needs  to  a  company,  ERMS’s 
overhead  consists  of  minimal  costs  such  as  travel,  communication  and  accounting. 

Although  ERMS  is  fully  functional  and  its  business  support  unit  is  fully  capable 
of  supporting  AFC  as  currently  constructed,  AFC  raised  some  serious  concerns  on 
ERMS’s  management’s  ability  to  support  them  in  processes  outside  of  their  credit  and 
retail  departments.  Their  concerns  were  twofold.  First,  if  AFC  decided  to  expand  the 
software  outside  of  its  credit  ands  retail  departments,  did  ERMS  have  the  capability  to 
support  that  task  from  an  implementation  and  training  perspective?  Second,  if  ERMS 
was  able  to  implement  the  software,  did  they  have  the  capability  to  provide  24/7  technical 
support  to  all  of  AFC’s  bank  locations  both  domestically  and  abroad?  These  questions 
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were  further  exacerbated  by  the  follow-on  questions  Albert  and  his  team  would  have  to 
answer  if  they  were  able  to  support  AFC  globally.  For  example,  would  support  of  AFC 
consume  all  of  ERMS’s  resources,  which  would  prevent  the  company  from  pursuing 
other  business  contracts?  Furthermore,  to  support  a  global  solution  should  they  adjust 
their  pricing  model?  Finally,  at  current  staffing  levels,  if  they  detennined  they  could  not 
support  AFC  and  additional  customers,  what  are  the  next  steps  they  should  take  in 
growing  their  business?  These  were  alternative  considerations:  should  they  continue  to 
finance  organically  and  hire  and  procure  additional  resources  as  funds  became  available, 
should  they  pursue  funding  by  venture  capital  firms  and  private  equity  investors;  or 
should  they  sell  the  company  and  rights  to  the  software  and  exit  the  business  altogether? 
The  purpose  of  this  business  plan  is  to  detennine  possible  courses  of  action  for  all  of 
these  possibilities  along  with  an  unqualified  recommendation  as  to  which  course  of  action 
is  the  most  beneficial  to  the  owners  of  ERMS. 
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II.  RISK  MANAGEMENT  BUSINESS  ENVIRONMENT 


Prior  to  beginning  the  strategic  analysis  of  ERMS  it  is  important  to  define  strategy 
and  how  that  strategy  has  influenced  the  development  of  ERMS.  Next,  analysis  of  how 
that  development  has  positioned  ERMS  in  the  industry  must  be  considered  in  order  to 
build  an  effective  strategy.  Regardless  of  size  or  age  of  a  business,  a  company  should 
develop  a  strategic  plan  immediately.  Upon  release  of  the  strategy,  management  should 
continually  review  the  strategy  and  ensure  all  employees  assigned  to  the  organization  are 
working  towards  optimizing  the  current  and  future  goals  of  the  strategic  position  their 
firm  has  taken  within  a  particular  industry.  Additionally,  the  organization  must  ensure 
the  strategy’s  content  is  clearly  defined,  relevant  and  innovative  (innovation  is  a  by¬ 
product  of  the  current  operating  environment,  market  and  conditions).  Finally,  the 
organization  must  ensure  management  allows  all  employees  assigned  to  their 
organization  to  execute  the  tasks  for  which  they  are  responsible,  without  interference,  in 
pursuit  of  the  strategic  initiative  that  exists  in  the  organization.  Otherwise,  development 
of  a  strategic  plan  will  prove  useless.  As  a  result,  examination  of  ERMS’s  current 
business  model  and  recommendations  for  improvement,  if  necessary,  will  be  the 
preliminary  step  for  developing  an  effective  strategy  for  ERMS  followed  by  a  strategic 
analysis  in  terms  of  the  concepts  referenced  in  the  beginning  of  this  section. 

Analysis  of  ERMS’s  current  business  model  and  short-tenn  planning  policies 
reveal  a  considerable  delta.  Discussions  with  Albert  reveal  that  the  company  is  unsure  on 
how  to  proceed  in  attacking  short  and  long-term  goals  and  what  direction  development  of 
these  goals  will  lead  the  company  as  they  become  part  of  the  organization’s  overall 
strategy  and  vision.  Currently,  the  operating  techniques  used  by  the  company  are  “on  a 
need  to  know”  basis.  Albert  enlists  the  assistance  of  his  staff  as  needed  and  pursues 
potential  customers  in  a  similar  manner. 

Although  it  appears  ERMS  needs  to  make  immediate  progress  in  determining, 
developing  and  implementing  short-term  goals  and  creating  a  viable  business  plan, 
research  and  analysis  of  the  current  Risk  Management  Operating  Environment 
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demonstrate  otherwise.  Although  the  market  climate  will  be  addressed  in  detail  later  in 
this  analysis,  the  ability  of  any  small  business  to  enter  and  remain  competitive  in  the  Risk 
Management  environment  is  relatively  easy  and  is  likely  to  remain  so  for  several  years. 
Success  will  be  defined  and  determined  on  whether  or  not  entrants  into  this  business 
segment  can  quickly  act  and  tighten  up  their  shortfalls  (near  tenn)  and  determine  what 
method  (strategy)  will  work  best  for  them  to  enter  the  industry  and  remain  competitive  as 
the  market  matures.  As  explained  in  an  article  written  by  Tom  Eid  and  French  Caldwell 
on  Governance,  Risk  and  Compliance  (GRC)  within  the  financial  industry,  current 
industry  trends  and  future  projections  on  the  use  of  Risk  Management  Software  Tools 
suggest  an  expanding  market  both  domestically  and  internationally  with  a  predicted 
growth  rate  of  nearly  24%  through  2010.  [6]  Therefore,  the  fact  that  ERMS  has  a  viable 
product  which  is  ahead  of  many  industry  competitors  from  a  capabilities  perspective  (a 
concept  that  will  be  addressed  in  detail  later  on  in  this  paper)  will  allow  time  to  develop 
operational  objectives  and  strategic  visions  in  line  with  industry  competitors  without 
having  to  worry  about  being  overtaken  by  competitors.  Bottom  line,  what  ERMS  lacks  in 
structure  and  vision  it  makes  up  in  product  quality  and  capability,  one  that  is  innovative 
and  unique. 

ERMS  management  recognized  the  need  for  short-term  planning  and  goal  setting 
in  requesting  that  this  research  study  be  performed.  This  is  a  critical  review  that  must 
necessarily  precede  a  careful  strategic  analysis  of  the  business,  the  customer  needs,  and 
the  market.  As  discussed  in  the  opening  section  of  this  analysis,  ERMS  currently 
provides  software  and  services  to  AFC  and  is  in  negotiations  with  financial  institutions, 
an  accounting  consultant,  and  a  casino  about  possible  sale  and  support  of  their  risk 
management  software. 

Currently,  the  organization  consists  of  four  partners  and  five  contractors. 
Presently,  none  of  the  contractors  has  thoroughly  defined  job  descriptions  and  ERMS  is 
under  no  legal  obligation  to  pay  them  salaries  unless  clients  are  secured  and  their  services 
needed.  The  salaries  of  the  partners  are  similar  to  those  of  the  contractors  in  that  no 
compensation  is  distributed  unless  contracts  are  secured.  An  argument  could  be  made 
that  Albert  and  Kristine  are  explicitly  aware  of  their  employee  job  descriptions  and  that  a 
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formal  document  that  explains  their  responsibilities  exists.  However,  the  job  descriptions 
lack  a  specific  language  that  requires  the  individual  employee  to  bring  any  added  value  to 
the  company  during  times  of  inactivity,  a  concept  that  is  extremely  important  during  the 
infant  stages  of  a  small  business.  Furthermore,  an  evaluation  of  employee  responsibilities 
and  oversight  demonstrates  a  lack  of  accountability  on  management’s  part  to  ensure  that 
the  employees  bring  value  to  the  company.  In  an  organization  the  size  of  ERMS,  it  is 
critical  that  the  small  number  of  employees  have  assigned  tasks  that  bring  value  to  the 
company;  regardless  of  whether  or  not  that  value  is  tangible. 

As  ERMS  addresses  employee  responsibilities,  it  should  also  consider 
determining  all  of  the  tasks  that  must  be  accomplished  within  a  calendar  year  and  assign 
responsibilities  accordingly  or  create  new  positions  as  required.  They  can  “kill  two  birds 
with  one  stone”  by  doing  this.  They  will  be  able  to  identify  inefficient  employee  practices 
and  identify  resources  required  in  both  the  near  and  long  tenn.  While  executing  the 
process,  variables  such  as  future  growth,  continuous  salary  requirements  and  financial 
limitations  must  be  carefully  evaluated.  Suggestions  for  personnel  design  should  be 
determined  through  examination  of  their  organizational  structure  needs.  These  needs 
include  but  are  not  limited  to:  independent  and  clearly  defined  full-time  and  part-time 
positions,  creation  of  additional  employees  as  required  per  newly  acquired  contracts, 
supplemental  additions  to  current  job  descriptions  as  a  remedy  to  the  company’s 
responsibilities  outgrowing  their  financial  capabilities  in  the  short  term  and,  proper  job 
descriptions  and  annual  salary  requirements  for  all  positions.  Use  of  consultants  should 
only  be  detennined  on  a  case-by-case,  as  needed  basis.  ERMS  should  consider 
consulting  techniques  similar  to  this  project  that  uses  MBA  students  when  possible. 

Along  with  the  addition  of  more  clearly  defined  employee  responsibilities  and 
duties,  Albert  should  consider  the  creation  of  additional  departments  to  manage  the  added 
tasks  that  will  occur  as  ERMS  becomes  more  competitive  in  the  Risk  Management 
market.  I  use  the  term  “department”  loosely.  Establishment  and  hiring  of  individuals  in 
several  key  areas/positions,  for  the  time  being  will  help  Albert  in  the  long  run.  There  are 
several  reasons  for  this  but  the  most  beneficial  to  ERMS  is  that  it  will  allow  them  to 
demonstrate  to  large  organizations  that  it  can  support  global  solutions.  Furthermore,  if 
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ERMS  hires  its  additional  personnel  as  contractors/consultants  that  are  paid  strictly  on 
commission,  this  creates  a  variable  cost  that  will  reduce  financial  risk  and  increase 
flexibility.  Marketing,  human  resources  and  a  department  of  analysts  are  some  additional 
tasks/positions  that  ERMS  must  consider  in  the  short  term  if  it  is  to  remain  viable  in  the 
Risk  Management  arena. 

There  are  other  perfunctory  short-tenn  changes  ERMS  could  make  that  would 
lend  credibility  to  their  operations  and  bridge  the  gap  between  near  tenn  success  and 
strategic  objectives.  Although  many  of  these  changes  are  anything  but  seamless  and  will 
require  a  commitment  on  the  part  of  Albert  and  Kristine,  they  all  require  accomplishment 
at  some  point  as  ERMS  continues  to  grow  and  gain  market  share.  First,  if  for  no  other 
reason  then  to  give  ERMS  the  look  and  feel  of  an  actual  business  rather  than  a  concept, 
ERMS  should  consider  purchasing  or  leasing  facilities  to  conduct  their  business. 
Presently  they  work  out  of  their  home  and  conduct  the  majority  of  their  business  over  the 
phone  or  on  location  of  current  and  prospective  clients.  As  more  business  is  generated,  it 
will  not  always  be  cost  effective  to  travel  to  possible  customers.  Also,  inviting 
prospective  customers  to  a  residence,  although  it  could  be  seen  as  lending  a  personal 
touch,  may  well  be  seen  as  somewhat  unprofessional  and  does  not  present  a  good  image 
for  the  company. 

Another  area  that  ERMS  should  address  is  the  company’s  website.  There  is  no 
question  that  the  website  is  well  constructed  and  appeals  to  the  reader,  it  is  both  attractive 
and  user  friendly.  However,  there  are  flaws  that  are  easily  recognized  with  respect  to 
access  and  content.  For  example,  potential  Risk  Management  customers  seeking 
software  remedies  for  their  organizations  often  begin  by  searching  the  internet. 
Frequently,  they  begin  their  search  by  accessing  search  engines  such  as  Google,  Yahoo  or 
MetaCrawler  and  typing  in  a  command  with  a  combination  of  the  words  “risk,” 
“management,”  “enterprise,”  and  “control.”  Input  of  any  combination  of  theses  words 
will  not  bring  up  access  to  ERMS  on  the  displayed  page  or  for  several  pages  after  that,  on 
any  of  the  search  engines  mentioned.  According  to  Albert,  the  reason  for  this  is 
intentional.  He  feels  that  competitors  will  steal  ideas.  However,  there  are  other  ways  to 
keep  people  from  stealing  ideas. 
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For  example,  if  there  is  an  idea  or  concept  you  are  not  comfortable  displaying  to 
users,  do  not  include  those  ideas  on  the  website.  Also,  research  on  companies  that  are 
displayed  as  a  result  of  a  Risk  Management  search  demonstrate  that  they  are  very  careful 
in  the  content  provided  on  their  websites  and  usually  require  a  customer  to  contact  them 
through  email  or  by  phone  if  they  wish  to  get  secure  infonnation  that  is  not  available  on 
the  website.  The  reasons  for  this  are  twofold.  First,  the  infonnation  might  actually  be 
something  they  do  not  want  the  public  to  have.  Second,  it  is  a  tool  they  use  to  gather  the 
names  and  addresses  of  potential  customers  for  subsequent  follow-up  through  a  personal 
call  or  message  to  solicit  their  business.  Therefore,  Albert’s  concerns  about  privacy  and 
security  are  more  of  a  disadvantage  to  the  company  then  an  advantage.  Finally,  as 
currently  constructed,  there  is  no  way  for  Albert  to  monitor  whether  or  not  their  website 
is  even  bringing  any  value  to  the  company.  The  site  manager  is  unable  to  provide  any 
data  on  the  number  of  visitors  that  use  ERMS’s  website  per  day,  week  or  month.  There 
is  a  caveat  to  the  lack  of  actual  hits  on  ERMS,  when  the  phrase  “risk  management”  is 
entered  into  a  search  engine.  Enterprise  Risk  Management  Solutions,  ERMS,  as  referred 
to  in  the  majority  of  its  literature,  is  much  too  generic  for  differentiation  on  the  search 
engine  or  among  competitors.  Therefore,  I  strongly  recommend  that  Albert  and  Kristine 
consider  changing  the  company  name  and  consider  other  methods  that  would  ensure  their 
organization  is  more  easily  accessed  via  the  internet. 
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III.  STRATEGIC  ANALYSIS 


In  this  section,  we  will  explore  strategic  goals  for  ERMS  based  on  the  strategic 
analysis  techniques  introduced  at  the  beginning  of  this  section.  The  primary  strategic 
methods  will  use  the  frameworks  developed  by  Michael  Porter  at  the  Harvard  Business 
School  in  1979.  As  defined  by  Porter,  industries  can  be  evaluated  by  using  five  forces  for 
assessing  competitive  attractiveness  and  a  firm’s  strategic  position  within  that  industry. 
The  five  forces  are:  rivalry,  the  threat  of  substitutes,  buyer  power,  supplier  power,  and 
barriers  to  entry.  The  framework  is  in  textbook  material  for  modem  business  studies  and 
therefore  widely  known.  The  five  forces  include  three  forces  from  a  horizontal 
competitive  position:  threat  of  substitute  products,  the  threat  of  established  rivals,  and  the 
threat  of  new  entrants;  and  two  forces  from  vertical  competitive  position:  the  bargaining 
power  of  suppliers  and  the  bargaining  power  of  customers  [7].  Defining  the  market  and 
competitors  that  exist  in  the  Risk  Management  arena  is  the  first  step  in  development  of  a 
strategic  analysis. 

Financial  Risk  Management  markets  have  come  into  prominence  because 
compliance  regulations  worldwide  are  driving  high-profile  publicly  traded  companies  to 
implement  laborious  financial  compliance,  corporate  governance  and  risk  management 
programs  into  their  reporting  requirements.  The  requirements  and  market  opportunity  are 
worldwide  in  scope  because  companies  that  are  U.S.  Securities  and  Exchange 
Commission  registrants  must  comply  with  the  Sarbanes-Oxley  Act  of  2002  (SOX), 
regardless  of  whether  their  headquarters  are  located  in  or  out  of  the  U.S.  In  response, 
some  countries,  such  as  Canada  and  Japan,  have  aligned  their  own  financial  reporting 
rules  with  SOX.  As  evidence  of  the  demanding  SOX  requirements,  some  international 
companies  have  abandoned  U.S.  markets  in  order  to  avoid  compliance  requirements.  By 
2008,  more  than  75  percent  of  large  and  midsize  companies  will  purchase  new 
compliance  management,  monitoring  and  automation  solutions  (0.8  probability).  Through 
2012,  fewer  than  30  percent  of  companies  will  pursue  an  integrated  strategy  of  a  risk- 
oriented  approach  to  compliance,  standardization  of  controls  and  automation,  thereby 
limiting  the  value  of  compliance  investments  (0.7  probability).  By  2012,  the  numbers  of 
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regulations  that  directly  affect  IT  operations  will  double  (0.7  probability)  [8].  As 
demonstrated  by  this  data  it  is  clear  that  Government  Risk  Compliance  Management  is  a 
market  that  provides  several  opportunities. 

Although  the  definition  of  risk  management  and  GRC  leave  little  to  interpretation, 
the  potential  market  they  represent  is  subject  to  uncertainty  based  on  the  relatively  young 
age  of  these  new  legal  and  regulatory  requirements.  An  optimistic  perspective  would  be 
driven  by  the  opportunity  to  be  a  leader.  Thus,  the  Financial  Risk  Management  Market, 
for  purposes  of  this  analysis,  will  be  defined  as  a  relatively  young  market,  with  clearly 
defined  requirements  and  plenty  of  opportunities  for  competitors. 

A.  FIVE  FORCES  ANALYSIS 

First,  I  will  begin  by  examining  ERMS’s  strategic  position,  philosophy  and 
guidance  through  the  horizontal  components  of  Porter’s  five  forces.  Initially,  two  of  the 
horizontal  components,  threat  of  substitutes  and  threat  of  new  entrants  are  discussed 
together  because  many  of  the  concepts  and  influences  that  exist  from  a  strategic 
standpoint  are  the  same  or  similar  for  both  forces.  Analysis  of  the  third  horizontal 
component  included  in  Porter’s  model,  threat  of  established  rivals,  along  with  the  vertical 
components,  the  bargaining  power  of  suppliers  and  the  bargaining  power  of  customers, 
will  follow  and  be  discussed  individually. 

Based  on  concerns  from  Albert  about  the  security  of  the  software  he  has 
developed  there  is  tremendous  risk  of  substitution  in  the  risk  management  market.  As 
mentioned  several  times  throughout  this  analysis,  Albert  has  significant  concerns  about 
securing  the  content,  technical  capabilities  and  innovative  characteristics  of  ERMS.  He 
believes  that  if  more  mature  competitors,  or  even  start-ups  like  ERMS,  were  to  gain 
access  to  his  software’s  unique  artificial  intelligence  and  control  capabilities  they  could 
easily  duplicate  or  imitate  the  software  code  and  process  approach  embedded  in  ERMS’s 
software.  Thus,  this  concern  inhibits  his  company’s  potential  to  exploit  the  market  for 
ERMS’s  competitive  advantage  that  differentiates  ERMS  from  competitors.  Albert  is  not 
the  only  one  who  believes  that  the  threat  of  substitution  (e.g.,  reverse  engineering)  is  an 
issue  that  exists  throughout  the  industry.  This  fear  exists  throughout  the  industry  as 
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discovered  by  my  own  analysis  of  several  competitors.  For  example,  two  companies 
considered  by  many  analysts  to  be  prominent  risk  management  companies  in  the  industry 
are  Methodware  and  Symbiant  Risk  Suite.  Consultants  for  Methodware,  and  Symbiant 
Risk  Suite  were  not  cooperative  when  asked  questions  about  the  unique  capabilities  of 
their  risk  management  software.  As  discussed  earlier  the  information  provided  on  their 
website  provided  only  superficial  data  about  their  product  and  company’s  operations. 
After  submitting  an  email  requesting  additional  information  on  their  products,  I  was 
contacted  over  the  phone.  In  both  cases,  when  I  explained  that  I  was  simply  a  graduate 
student  exploring  the  newly  developed  risk  management  industry  as  part  of  thesis  work,  I 
was  able  to  extract  infonnation  that  differed  from  that  provided  on  their  websites.  It 
appears  that  both  consultants  felt  comfortable  that  I  was  not  a  competitor,  but  perhaps  a 
possible  contract  that  they  might  be  able  to  pursue  with  the  U.S.  government. 
Consequently,  if  you  believe  you  have  a  competitive  edge  based  on  differentiation,  your 
organization  is  at  a  distinct  advantage.  But  all  must  be  aware  that  the  threat  of 
substitution  is  real  and  safeguarding  of  creative  innovations  in  the  risk  management 
business  is  critical  to  survival  in  this  nascent  industry.  This  also  indicates  that  even  if 
you  are  not  currently  entrenched  in  the  industry,  access  to  market  share  is  relatively  easy 
if  you  have  reasonable  financial  and  human  resources  available  to  initiate  entry. 

B.  TO  PATENT  OR  NOT? 

Issues  concerning  safeguarding  innovative  software  within  the  industry  place 
ERMS  in  a  difficult  position  and  present  Albert  and  his  staff  with  an  interesting  dilemma. 
After  several  discussions  with  patent  attorneys  about  how  to  best  safeguard  ERMS’s 
unique  software  capabilities  Albert  is  undecided  as  to  whether  ERMS  should  seek  patent 
protection  or  navigate  unprotected  through  the  competitive  market  and  risk  having  his 
technology  duplicated  by  a  larger  competitor  with  more  resources.  Without  the 
additional  resources,  the  latter  choice  places  ERMS  at  an  even  greater  disadvantage  as  it 
seeks  to  penetrate  the  market. 

According  to  his  lawyers,  once  a  patent  is  submitted  to  the  U.S.  Patent  Office  it  is 
available  for  public  review.  Therefore,  it  is  very  likely  that  a  large  company  such  as 
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Oracle,  SAP  or  Microsoft  has  software  experts  constantly  scanning  pending  patents  to 
uncover  new  and  innovative  business  opportunities  to  improve  or  increase  their  product 
portfolio.  Although  the  company  would  be  prohibited  from  copying  ideas  directly  from 
those  reviewed,  there  is  nothing  in  the  patent  process  that  keeps  competitors  from 
developing  software  code  that  will  perform  the  same  tasks  but  in  a  different  routine  so  as 
to  avoid  patent  infringement. 

Another  disadvantage  to  the  patent  process  is  that  lawsuits  on  patent  infringement 
are  very  costly  and  may  span  several  years  before  they  are  resolved.  For  this  reason, 
unless  the  innovation  a  company  is  seeking  to  patent  is  so  unique  that  duplication  can  be 
easily  proven,  small  companies  like  ERMS  are  placed  in  a  difficult  position  when 
considering  the  financial  benefits  a  patent  might  bring  their  organization. 

On  the  positive  side  of  patenting  is  the  possibility  that  if  a  company  such  as 
Oracle,  SAP  or  Microsoft  were  to  examine  another  company’s  innovative  software  and 
consider  it  a  ground  breaking  revolution,  they  could  decide  to  acquire  the  technology  by  a 
buyout  of  the  company  that  holds  the  rights  to  the  pending  patent.  This  frequently  occurs 
in  the  software  industry  (e.g.,  Microsoft  recently  acquired  MySource). 

Hence  the  dilemma  faced  by  ERMS:  should  they  seek  a  patent  and  ignore  the 
threat  of  substitution  yet  enjoy  some  of  the  protection  a  patent  offers.  This  is  a  major 
strategic  decision  that  needs  to  be  settled  soon.  It  would  be  easy  to  ignore  the  patent  and 
hope  that  the  current  market  climate  brings  profitable  opportunities  at  different  levels  in 
the  industry.  This  would  avoid  the  convoluted  and  costly  process  involved  in  obtaining  a 
patent. 

The  technology  embedded  in  ERMS’s  software  package  is  a  classic  example  of 
Porter’s  dichotomy  of  strategic  competitive  analysis.  That  is,  a  company  must  seek  to 
compete  with  a  differentiation  strategy  in  an  industry  that  anticipates  market  growth  and 
innovation.  The  other  extreme  in  Porter’s  industry  analysis  is  to  be  low  cost  producer  in 
a  commodity  industry.  The  software  application  in  risk  management  does  not  fit  the  low- 
cost  producer  strategy,  since  technology  is  constantly  improving  the  market  for 
innovative  and  creative  software  solutions,  especially  in  this  new  legalistic  and  regulated 
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business  environment.  Hence  the  patent  issue  takes  on  great  importance  if  ERMS’s 
growth  and  survival  depend  on  the  uniqueness  of  its  one  software  package.  The  stakes 
are  high  but  so  are  the  business  risks. 

Considering  all  issues,  if  Albert  believes  the  company  has  a  break-through 
software  package  and  the  financial  resources  necessary  to  see  the  process  through  until 
the  end,  I  recommend  that  ERMS  should  pursue  the  patent  protection.  My  rationale  for 
this  is  twofold.  First,  throughout  the  process  Albert  has  held  steadfastly  to  the  idea  that 
ERMS’s  capabilities  are  100  percent  unique  in  the  risk  management  industry.  Thus, 
duplication  would  be  difficult,  and  even  the  creation  of  similar  software  would  still  be 
considered  inferior  to  that  of  ERMS.  Also,  the  exposure  a  pending  patent  might  bring 
ERMS  in  the  market  place  from  a  positive  perspective  could  really  only  benefit  the 
company.  I  am  quite  certain  that  companies  with  personnel  assigned  to  monitor  pending 
innovations  and  technical  advances,  if  relevant,  would  begin  to  see  ERMS  as  a  serious 
player  in  the  market  —  and  that  can  only  be  seen  as  a  good  thing.  Finally,  if  a  large 
company  views  the  technology  as  a  complementary  business  opportunity  they  might 
pursue  purchase  of  the  product,  which  may  create  a  financial  windfall  for  Albert  and  his 
partners.  Another  alternative  is  that  a  company  might  offer  to  license  the  software. 

Initially,  it  appeared  that  Albert’s  anxiety  about  the  security  and  privacy  of 
ERMS’s  technical  capabilities  was  the  one  area  for  which  he  sought  outside  assistance 
through  this  research  and  analysis  perspective.  The  threat  of  large  established  rivals, 
however,  is  actually  the  major  concern  for  Albert  as  he  introduces  his  product  to  the 
market  and  exposes  it  to  competitors.  Initial  analysis  of  the  market  and  industry  indicates 
that  there  are  several  competitors  that  are  well-entrenched  in  the  management  software 
business.  Therefore,  they  may  counter  some  of  those  advantages  a  small  business  might 
have  from  the  analysis  of  the  factors  discussed  above.  Over  the  course  of  the  next  several 
pages,  I  will  provide  information  on  the  competitors  I  believe  offer  the  biggest  challenge 
to  ERMS,  and  provide  analysis  and  recommendations  on  how  to  best  deal  with  them. 
First,  it  is  important  to  present  the  research  methods  that  were  used  to  identify  the 
industry  leaders.  By  simply  accessing  the  internet  and  typing  in  some  combination  of  the 
tenn  “operational  risk  management  software,”  a  user  will  receive  several  hits.  Actually, 
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users  will  encounter  too  many  possibilities  to  effectively  determine  the  differences 
between  those  companies  that  are  considered 

•  stalwarts  in  the  industry; 

•  those  that  are  relatively  new  but  offer  a  quality  product;  and 

•  those  that  are  merely  imposters  hoping  to  capitalize  on  a  market  that  is 
relatively  new  and  therefore  provide  opportunities  for  some  businesses  to 
earn  revenues  that  they  would  be  unable  to  procure  if  the  market  was 
better  established. 

Although  internet  search  engines  provide  users  with  several  industry  competitors, 
this  is  not  a  method  that  will  provide  any  type  of  immediate  feedback  to  begin  analysis. 
However,  it  was  useful  to  establish  a  starting  point.  By  initiating  some  cursory 
discussions  with  Albert  and  his  team,  along  with  professors  in  the  business  school  at  NPS 
(those  with  a  working  knowledge  of  risk  financial  risk  management  firms),  I  was  able  to 
build  a  list  of  companies  they  all  believed  to  be  the  prominent  names  in  the  industry. 
Once  the  list  was  complete,  I  did  an  initial  scrub  of  their  websites  to  determine  if  the 
software  they  provided  was  similar  to  ERMS,  whether  that  similarity  was  tit  for  tat,  or  a 
substitute.  If  I  determined  that  there  was  reason  for  further  analysis  I  requested  more 
information  from  the  company  via  their  contact  through  the  email  package  provided  on 
their  website.  All  requests  contained  the  same  language.  I  introduced  myself  as  an  MBA 
student  compiling  data  for  a  research  project  on  risk  management  and  the  software 
industry  it  parallels,  and  a  request  that  they  contact  me  telephonically  to  discuss. 

Consolidation  of  provided  companies  and  ensuing  research  provided  the 
following  three  companies  as  posing  the  biggest  competitive  challenge  to  Albert  and  his 
staff:  Paisley,  Open  Pages,  and  Methodware.  These  three  are  large  and  well-known 
companies  throughout  the  industry.  Additionally,  Approva,  Logical  Apps  and  Virsam, 
are  relatively  new  but  provide  software  that  would  be  considered  the  most  similar  to  that 
provided  by  ERMS.  These  three  are  also  well  known  but,  based  on  their  relative  infancy 
in  the  industry,  are  not  nearly  as  recognizable  as  the  others. 

Although  the  large  companies  claim  differentiation  in  software  distinguishing 
their  product  from  the  others,  in  my  opinion  those  claims  are  somewhat  unfounded. 

Although  I  believe  the  software  provided  by  Paisley  appears  to  be  somewhat  inferior  to 
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that  of  Open  Pages  and  Methodware,  for  the  most  part,  they  seem  to  provide  the  same 
functionality.  They  primarily  focus  on  assisting  financial  institutions  in  identifying  or 
consolidating  Key  Risk  Indicators  (KRI’s),  organizing  them  in  a  manner  that 
demonstrates  to  internal  and  external  auditors  that  the  company  is  aware  of  regulated 
risks  as  they  occur  during  a  particular  process  or  activity,  and  then  displays  what  controls 
have  been  established  to  mitigate  the  identified  risk.  All  three  software  packages  have  a 
similar  look  and  feel.  However,  Paisley’s  software  lacks  some  of  the  innovation 
provided  by  the  others  in  regards  to  KRI  identification  assistance. 

Paisley’s  software  consolidates  and  organizes  previously  used  manual  risk 
assessment  models  along  with  the  checklist  that  accompanies  those  models.  The  models 
I  am  referring  to  consist  only  of  industry  specific  (generic)  financial  risks  as  opposed  to 
both  industry  and  company  specific  financial  risks.  Paisley  does  provide  automated 
tracking  of  those  controls  implemented  by  an  organization  to  mitigate  risk  and  identifies 
whether  the  control  has  been  executed  by  an  individual  employee.  Unlike  other  vendors’ 
software,  I  was  unable  to  do  a  hands-on  demonstration  with  Paisley.  However,  Albert 
conducted  an  assessment  via  the  demo  provided  on  their  website.  It  appears  that  there  is 
no  mechanism  in  place  to  assist  management  is  identifying  risk  other  then  those  provided 
within  the  initial  software  package.  Primarily,  Paisley  acts  as  an  automated  replacement 
to  old  paper  trail  audit  systems  that  allow  financial  institutions  to  demonstrate  automated 
compliance  with  many  of  the  newly  implemented  accounting  regulations.  Throughout 
the  industry  this  is  referred  to  as  an  automated  work  audit  process,  not  an  actual  risk 
management  tool  where  the  efficiency  that  an  organization  manages  risk  is  improved. 
According  to  their  competitors,  this  makes  their  claims  and  software  capability  inferior  to 
those  of  companies  like  Open  Pages  and  Methodware. 

Paisley  believes  that  its  software  package  improves  organizational  control  of 
financial  processes  and  that  such  a  tool  is  easily  incorporated  into  an  institution’s 
business  model  and  therefore  is  a  cost  effective  solution  to  managing  financial  risk  and 
demonstrating  compliance.  Although  I  was  unable  to  get  pricing  information  from 
Paisley,  I  believe  that  they  have  carved  out  a  niche  in  the  industry.  They  are  offering 
their  product  at  a  price  moderately  lower  than  competitors  and  targeting  financial 
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institutions  that  are  in  the  infant  stages  of  dealing  with  operational  risk  and  controls. 
These  financial  institutions  do  not  have  the  capital  and  resources  to  afford  some  of  the 
more  expensive  and  functional  software  packages  available  on  the  market.  Even  though 
Paisley  is  considered  a  major  player  in  the  industry,  based  on  information  provided  on 
their  website  and  via  a  conversation  with  one  of  their  account  executives,  I  would  say 
they  have  a  long  way  to  go  if  they  plan  to  compete  for  the  same  customer  base  as  those 
enjoyed  by  the  Methodware  and  Open  Pages.  This  is  also  consistent  with  the  statement 
that  they  are  targeting  smaller  financial  institutions  or  organizations  that  lack  the 
resources  to  commit  large  amounts  of  money  to  Governance  Risk  and  Compliance 
requirements.  Another  indication  of  Paisley  targeting  only  smaller  financial  institutions 
is  their  reluctance  to  disclose  their  client  list  on  their  website.  By  making  such 
information  public,  Paisley  could  significantly  enhance  the  credibility  of  their  software  if 
their  current  client  list  consisted  of  large,  profitable  and  well-established  financial 
institutions. 

What  distinguishes  both  Open  Pages  and  Methodware  from  competitors  is  their 
software’s  ability  to  provide  a  tool  to  determine  whether  or  not  management  needs  to 
consider  examining  other  risk  within  a  business  process  brought  about  by  the  default 
KRI’s  provided  by  most  risk  management  software  provided  in  the  industry. 
Furthermore,  their  software  allows  their  clients  the  ability  to  implement  their  own  risks 
and  identified  controls  into  the  package  without  requiring  modification  of  the  standard 
software  package. 

I  was  able  to  attend  a  one-on-one  meeting  with  Jake  Simmons  an  executive  with 
Method  Ware,  during  which  he  demonstrated  the  company’s  unique  (in  his  opinion) 
ability  to  assist  user’s  in  building  additional  KRI’s  and  controls  into  their  software. 
Throughout  the  demonstration,  it  was  evident  that  all  identification  and  implementation 
was  completed  without  the  need  of  technical  assistance.  For  the  most  part,  it  appeared 
that  if  the  user  was  able  to  navigate  through  the  provided  windows,  he  or  she  could 
indeed  accomplish  all  of  the  software  tasks  that  Methodware  claimed  were  available. 
However,  as  I  observed  the  demonstration,  I  doubted  users  at  the  middle  and  lower  levels 
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of  an  organization  would  be  able  to  navigate  their  way  through  the  system.  I  addressed 
the  question  of  ease  of  use  to  Jake,  who  acknowledged  the  company  was  trying  to 
improve  this  area.. 

I  was  not  able  to  personally  observe  application  of  the  Open  Pages  software. 
However,  I  can  say  with  confidence  that  Open  Pages  software  generally  provides  the 
same  functionality  as  that  provided  by  Methodware  based  on  Albert’s  analysis  of  the 
online  demo  and  my  research  of  the  company.  After  conducting  independent  research,  I 
was  able  to  determine  that  Open  Pages  and  Methodware  are  almost  identical  in  the 
software  they  offer,  much  like  a  pair  of  basketball  shoes  provided  by  Nike  vice  Adidas. 
What  allows  them  to  operate  successfully  as  independent  entities  appears  to  be  their 
target  markets  and  price  point  of  their  software. 

Open  Pages’  published  client  list  includes  several  domestic  firms  along  with  a 
sprinkling  of  international  firms  while  Methodware ’s  customer  list  includes  several 
international  firms  along  with  a  sprinkling  of  domestic  firms.  This  concentration  of 
clients  seems  to  be  supported  by  the  location  of  their  home  office  based  on  their  home 
office.  Methodware  is  based  in  Australia  with  an  office  in  the  U.S.  that  employees 
approximately  twenty  personnel  while  Open  Pages  is  based  in  the  U.S.  with  smaller 
international  offices  established  to  support  global  customers.  Both  customer  lists  are 
extremely  impressive  and  lend  credibility  to  the  stature  of  each  competitor  similar  to 
brand  recognition.  Open  Pages  more  impressive  clients  are  SABMiller,  GEICO  and 
Kodak  which  are  relatively  large  businesses.  Methodware ’s  more  impressive  clients  are 
Bank  of  Tokyo  Mitsubishi,  Coca  Cola  South  Africa  and  University  of  Phoenix.  Both 
companies’  customer  list  is  extensive. 

Another  area  where  one  company  might  differentiate  itself  from  the  other  is 
selling  price.  According  to  Jake  Simmons,  his  company  prices  its  software  package  on 
what  he  considered  the  low  end  of  market  providers.  He  quoted  a  price  of  approximately 
$120,000  annually,  $30,000  in  licensing  fees  and  $80,000  in  user’s  fees  (the  majority  of 
their  contracts  were  based  on  100  users).  If  that  is  actually  the  case,  then  Methodware 
might  attract  some  of  its  customers  based  on  pricing  its  software  lower  than  Open  Pages. 

This  seems  reasonable  since  Albert  based  his  selling  prices  using  the  same  philosophy 
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and  there  is  little  difference  in  ERMS’s  price  and  Methodware’s.  I  was  unable  to  get 
selling  price  data  on  Open  Pages,  but  it  would  tend  to  make  sense  based  on  their 
customer  base  and  market  that  they  might  price  their  product  slightly  higher  than 
domestic  competitors  as  they  might  be  seen  as  the  industry  leader. 

Based  on  an  interview  with  an  executive  who  works  with  Protiviti  (an 
independent  financial  risk  management  consulting  firm  based  in  San  Francisco),  I 
identified  some  competitors  that  had  not  been  on  Albert’s  radar  or  for  that  matter  any  of 
the  financial  risk  management  experts  I  had  talked  to  in  the  early  portion  of  the  project. 
Protiviti  is  a  company  that  provides  consulting  and  advisory  services  to  help  potential 
clients  identify,  assess,  measure  and  manage  financial,  operational  and  technology-related 
risks  encountered  in  their  industries,  and  assist  in  the  implementation  of  the  processes  and 
controls  to  enable  their  continued  monitoring.  They  also  offer  a  full  spectrum  of  internal 
audit  services  to  assist  management  and  directors  with  their  internal  audit  functions, 
including  full  outsourcing,  co-sourcing,  technology  and  tool  implementation,  and  quality 
assessment  and  readiness  reviews  [9],  I  uncovered  the  company  while  researching  GRC 
and  believe  that  they  have  been  able  to  provide  the  most  reliable  infonnation  on  the  risk 
management  software  industry  along  with  unbiased  opinions  on  market  trends  and 
competition.  I  believe  this  because  although  they  do  offer  some  software  solutions  for 
auditing  financial  controls,  their  primary  interest  is  to  assist  companies  as  they  begin  their 
quest  to  comply  with  government  directed  regulations.  As  a  result  it  is  their  job  to 
determine  methods  for  compliance  followed  by  those  solutions  they  believe  to  be  the 
most  beneficial  to  an  institution.  Therefore,  after  analyzing  a  particular  company,  they 
might  actually  recommend  the  company  use  the  solutions  provided  by  Methodware  on 
one  occasion  and  Open  Pages  on  another.  I  explained  to  the  executive  what  Albert 
believed  to  be  the  function  that  differentiated  ERMS  from  competitors  and  based  on  his 
experience,  he  believed  that  there  was  some  truth  to  Albert’s  claim.  However,  he  gave 
me  the  name  of  three  relatively  new  firms  that  he  thought  made  similar  claims  of 
functionality  as  ERMS  and  recommended  I  do  some  research  on  each.  The  firms  he 
mentioned  were  Approva,  Logical  Apps  (recently  purchased  by  Oracle)  and  Virsam 
(recently  purchased  by  SAP). 
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After  conducting  analysis  of  Approva,  Logical  Apps  and  SAP’s  software,  I 
believe  they  offer  significant  challenges  to  ERMS.  There  are  several  reasons  for  this. 
Among  those  I  believe  present  the  most  significant  challenge  to  ERMS  are:  the  ability  to 
act  as  substitutes  to  ERMS’s  claim  of  unique  financial  control  execution,  superior  brand 
recognition,  complimentary  capabilities  of  other  business  related  software  packages 
provided  by  the  companies,  and  availability  of  capital.  First,  and  what  will  be  the  biggest 
challenge  ERMS  will  face  as  it  works  to  establish  its  position  in  the  market,  is  the 
question  of  control  execution  differentiation.  As  previously  discussed  in  this  analysis, 
ERMS  is  able  to  take  management’s  KRI’s,  develop  controls  to  mitigate  determined  risk, 
and  then  take  the  process  one  step  further  by  managing  and  executing  the  implemented 
control  with  the  automated  tools  provided  by  ERMS.  According  to  Albert,  ERMS’s 
ability  to  manage  controls  is  exponentially  better  than  that  of  any  of  the  competitors. 
Albert  refers  to  ERMS’s  unique  ability  to  manage  controls  as  “artificial  intelligence.”  I 
believe  that  an  institution  looking  to  purchase  GRC  software  would  scrutinize  the  claims 
made  by  ERMS,  compare  them  to  the  claims  of  Logical  Apps,  Approva  and  SAP  and 
come  to  the  same  conclusion;  they  all  assist  management  in  executing  mitigating  controls 
to  some  degree.  Therefore,  whether  or  not  one  does  it  better  than  another  might  not  be  as 
critical  to  the  purchasing  process  as  Albert  believes  it  is. 

Albert  must  be  aware  that  unless  there  is  significant  value  added  to  the  way 
financial  controls  are  managed  using  ERMS,  the  use  of  artificial  intelligence  probably 
becomes  insignificant  in  the  decision  process  used  to  determine  what  software  package  a 
potential  customer  purchases.  Therefore,  Albert  should  seriously  consider  the  control 
capabilities  of  these  companies  and  reevaluate  ERMS’s  ability  to  claim  differentiation  as 
one  of  the  key  components  to  his  product’s  strategic  platform  before  making  any  long¬ 
term  commitments  to  the  claim.  The  reason  for  this  is  simple,  when  developing  a 
strategic  plan  from  the  perspective  of  substitution  as  it  relates  to  Porter’s  Five  Forces; 
there  is  no  question  that  all  three  companies  can  replace  ERMS  as  a  substitute  in  one  way 
or  another.  Whether  or  not  that  threat  is  significant  enough  for  Albert  to  adjust  his 
company’s  strategic  position  as  it  relates  to  the  threat  of  substitutes  is  a  decision  he  must 
consider  as  he  develops  his  strategic  plan  and  grows  his  company. 
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Another  serious  challenge  ERMS  faces  from  Approva,  SAP  and  Logical  Apps  is 
brand  recognition.  With  the  exception  of  Approva,  SAP  and  Logical  Apps  (a  component 
of  companies  running  Oracle  based  business  solutions)  there  is  no  question  that 
businesses  associated  with  the  technology  sector  are  familiar  with  SAP  and  Oracle.  Even 
if  potential  customers  are  not  aware  of  the  products  and  services  they  provide,  there  is  a 
good  chance  that  they  are  familiar  with  their  names.  Small  businesses  hoping  to 
penetrate  a  particular  market  or  geographic  region  need  to  be  aware  of  the  existence  of 
those  organizations  in  that  industry  whose  name  provides  comfort  to  prospective 
customers  and  understand  that  it  might  benefit  them  to  avoid  those  regions  where  brand 
superiority  might  exist. 

Another  consideration  with  respect  to  brand  recognition  that  Albert  should 
consider  is  the  client  list  of  competitors.  Much  like  the  ability  of  potential  customers  to 
recognize  a  supplier  through  a  product’s  brand  name  is  the  recognition  of  current 
customers  using  a  particular  product.  If  a  company  is  conducting  thorough  research  of  a 
potential  supplier,  they  might  refer  to  the  client  list  of  that  company  and  see  whether  or 
not  other  customers  have  demonstrated  confidence  in  that  product.  If  there  is  a 
demonstrated  interest  by  well-known  current  customers,  undecided  customers  might  be 
more  willing  to  purchase  the  product  of  a  competitor  that  has  a  well  known  and 
established  client  base.  While  Logical  Apps  provides  no  current  client  list  on  its  website, 
both  SAP  and  Approva  provide  extensive  lists.  Similar  to  Open  Pages  and  Methodware 
both  lists  are  impressive  and  need  to  be  considered  when  ERMS  is  determining  what 
sector  of  the  market  it  believes  is  the  most  realistic  to  penetrate.  Among  some  of 
Approva ’s  more  impressive  clients  are  Proctor  and  Gamble,  DIRECTV  and  Bayer. 
Among  some  of  SAP’s  more  impressive  clients  are  Marathon  Oil  and  Siemens. 

The  final  component  of  horizontal  strategic  analysis  and  threat  of  substitutes  that 
Albert  should  consider  is  whether  or  not  a  competitor  can  provide  customers  with  quality 
complimentary  goods.  Although  Approva,  SAP  and  Logical  Apps  all  provide 
complimentary  products  and  services  to  their  customers,  ERMS  should  be  most 
conscious  of  the  threat  posed  by  SAP  and  Logical  Apps.  SAP  offers  the  ability  to 
provide  ERP  business  solutions  for  customers  directly  linked  to  its  GRC  software. 
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Therefore,  SAP  poses  a  unique  threat  to  any  competitive  entrant  into  the  industry.  On  the 
other  hand,  with  Logical  Apps  link  to  Oracle’s  software  solutions,  competitors  face 
similar  challenges.  As  ERMS  navigates  its  way  through  the  horizontal  components  of 
Porter’s  Five  Forces,  Albert  will  have  to  determine  creative  ways  to  compete.  There  is 
no  question  that  he  must  detennine  creative  and  innovative  methods  to  keep  ERMS  from 
being  squeezed  out  of  the  sectors  he  chooses  to  penetrate  based  on  the  challenges 
discussed  above. 

The  last  two  tools  provided  for  strategic  analysis  by  Porter’s  Five  Forces  are  the 
bargaining  power  of  suppliers  opposed  to  the  bargaining  power  of  customers  held  by  one 
over  the  other  when  considering  the  exchange  of  goods  and  services.  Within  the 
financial  risk  management  industry  these  factors  can  be  analyzed  together  because  of  the 
industry’s  relative  young  age  and  small  size.  Based  on  these  two  facts  alone  I  do  not 
believe  there  are  significant  differences  in  the  relative  positions  either  can  take  despite 
the  sector,  size  or  current  position  they  hold  in  the  market.  Based  on  the  research  and 
analysis  conducted  for  this  project,  current  and  future  trends  project  a  market  that  should 
remain  comparatively  unchanged  for  the  next  several  years.  As  a  result,  I  believe  that 
neither  the  supplier  nor  the  customer  holds  a  significant  advantage  over  the  other  when  it 
comes  to  predicting  market  leverage.  Another  explanation  for  this  conclusion  is  that 
currently  suppliers  and  customers  are  still  trying  to  figure  out  their  positions  relative  to 
each  other  within  their  own  entity  (i.e.,  where  does  an  organization  stand  in  the  pecking 
order  and  ability  to  influence  with  respect  to  other  suppliers  in  the  industry).  Therefore, 
how  could  one  possibly  employ  some  sort  of  competitive  edge  over  the  other? 

An  argument  could  be  made  that  the  fact  that  I  believe  that  this  will  remain  the 
case  for  the  foreseeable  future  is  a  poor  assessment.  Within  any  globally  competitive 
industry,  especially  the  tech  industry,  the  ability  to  remain  relevant  and  competitive  is 
often  defined  by  a  business’s  ability  to  implement  innovative  ideas  quickly  and  force 
competitors  to  adapt  to  your  innovation  or  face  possible  loss  of  market  share.  Because  of 
this,  growth,  change  and  power  among  competitors  and  suppliers  within  the  industry 
should  change  constantly  rather  than  remain  stable  for  the  foreseeable  future.  However, 
in  the  case  of  ERMS  and  the  financial  risk  management  industry  I  believe  the  foreseeable 
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future  is  no  more  than  the  next  three  years.  At  that  point  Albert  and  his  staff  can  analyze 
their  position  within  the  market  and  decide  if  the  strategic  landscape  has  changed  and 
whether  or  not  changes  must  be  implemented.  I  believe  this  to  be  the  case  for  ERMS 
based  on  the  speed  with  which  decisions  and  tasks  are  accomplished  in  the  market  Albert 
operates  today.  For  example,  Albert  and  his  team  have  been  working  to  secure  a  contract 
with  First  National  Bank  in  Omaha  since  early  2007,  and  although  they  felt  confident 
throughout  the  process  that  the  contract  would  be  secured,  it  is  now  May  2008  and  the 
contract  has  yet  to  be  finalized.  Therefore,  it  appears  that  the  business  side  of  the 
financial  risk  management  industry  still  has  some  developmental  issues  and  has  yet  to 
catch  up  with  the  pace  of  technology.  I  believe  that  this  is  further  demonstrated  by  the 
fact  that  Sarbanes-Oxley  was  established  in  2002  and  the  market  is  still  defining  itself 
and  has  no  clear  industry  leader  in  2008. 
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IV.  MARKETING 


ERMS  should  develop  a  marketing  plan  to  accomplish  its  goals  as  it  pursues 
penetration  of  the  financial  risk  management  market.  The  marketing  plan  should  include 
the  following  components:  an  Executive  Summary,  Situation  Analysis,  Market  Strategy, 
Financial  Requirements  and  Management  Controls.  The  development  of  an  Executive 
Summary  and  Situation  Analysis  can  easily  be  constructed  using  the  research  and 
subsequent  information  provided  by  the  strategic  analysis  in  this  paper.  However,  I  will 
provide  recommendations  on  the  third  and  fifth  components  of  a  marketing  plan  for 
ERMS:  Market  Strategy  and  Management  Controls.  The  recommendations  only  provide 
the  building  blocks  for  a  thorough  marketing  campaign  and  must  be  carefully  developed 
and  implemented  in  order  for  ERMS  to  realize  the  complete  benefits.  Finally,  due  to  the 
uncertainty  of  sales  and  revenues  that  currently  exist  throughout  the  financial  risk 
management  market  and  ERMS’s  relatively  new  position  in  the  market,  it  is  premature  to 
attempt  developing  a  financial  forecast.  However,  the  company  should  prepare  formal 
financial  statements  for  its  past  operations  and  a  statement  of  its  resources  and 
capitalization. 

A.  MARKET  STRATEGY 

A  successful  marketing  strategy  should  include  a  business’s  objectives,  target 
markets,  positioning,  strategies  with  respect  to  product,  pricing,  distribution,  and 
communications,  marketing  mix  and  research  [10]. 

B  BUSINESS  OBJECTIVES 

The  first  task  that  faces  ERMS  as  it  builds  its  marketing  strategy  is  to  determine 
company’s  short-term  goals.  For  purposes  of  this  analysis  and  based  on  ERMS’s  current 
position  in  the  market,  short-term  should  not  extend  past  two  years,  with  primary  focus 
on  the  first  year  of  operations.  Also,  ERMS  should  define  its  objectives  in  terms  of  the 
market  in  which  it  will  compete,  and  estimate  a  reasonable  share  of  that  market.  This 
will  provide  ERMS  two  benefits.  First,  it  will  focus  the  company  on  a  specific  goal  that 
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will  allow  Albert  to  evaluate  the  business  after  a  pre-detennined  amount  of  time.  It  will 
also  assist  Albert  in  detennining  whether  ERMS  is  headed  in  the  right  direction  with 
respect  to  its  marketing  objectives.  Rather  than  simply  stating,  “I  want  to  establish 
ERMS  as  a  competitor  in  the  financial  risk  management  market,”  Albert  should  state  an 
objective  for  ERMS  that  says,  “By  June  2009, 1  want  ERMS  to  have  achieved  a  2  percent 
market  share  of  the  financial  risk  management  market.”  Furthermore,  the  particular 
market  in  which  ERMS  wants  to  achieve  market  share  must  also  be  well  defined.  For 
example,  the  market  might  be  only  new  publicly  traded  financial  institutions  started 
within  the  past  eighteen  months.  Other  advantages  that  ERMS  will  enjoy  by  developing 
thorough,  quantifiable  objectives  is  that  it  will  provide  ERMS  with  a  set  of  tangible  goals 
rather  than  just  a  hope,  as  has  been  the  case  in  the  past,  for  improvement.  The  other 
benefit  of  defining  objectives  in  terms  of  market  share  is  that  it  will  force  Albert  and  his 
staff  to  gather  financial  data  and  operating  data  on  ERMS’s  competitors.  By  doing  this, 
ERMS  management  will  have  infonnation  on  their  competitors  that  will  prove  invaluable 
to  the  company  as  it  strives  to  become  a  viable  player  in  the  financial  risk  management 
market. 

Based  on  the  information  collected  for  this  project  and  the  analysis  that  follows,  I 
believe  that  Albert  should  set  ERMS’s  goal  at  15  percent  of  the  market  that  consist  of 
those  financial  institutions  that  are  in  the  process  of  applying  to  be  publicly  traded  and  15 
percent  of  the  financial  institutions  that  have  started  trading  publicly  in  the  past  three 
years.  If  Albert  chooses  to  move  in  another  direction,  he  might  consider  establishing  his 
market  share  objectives  based  on  the  annual  revenues  of  clients.  For  example,  Approva 
has  a  client  list  that  consists  of  Comcast,  who  generated  over  eight  billion  dollars  in 
revenue  in  2007;  T-mobile,  who  generated  just  over  four  billion  dollars  in  2007;  and 
Siemens,  who  generated  over  80  billion  dollars  in  revenue  in  2007.  Therefore,  it  is  quite 
clear  that  Approva  targets  clients  with  revenues  of  at  least  a  billion  dollars.  If  Albert 
chooses  to  target  ERMS’s  customers  similarly,  he  might  follow  the  lead  of  Approva,  but 
lower  the  revenues  of  his  targeted  clients  in  order  to  avoid  unnecessary  competition  with 
companies  like  Approva  and  Logical  Apps.  I  recommend  ERMS  target  companies  that 
consistently  earn  revenues  of  500  million  dollars  or  greater  annually.  Doing  this  will 
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provide  focus  and  establish  a  realistic  client  base  to  ERMS  as  it  works  to  become  a 
relevant  competitor  in  the  market.  It  is  also  likely  that  Albert  will  find  that  companies 
that  have  started  trading  publicly  in  the  past  three  years,  generate  500  million  dollars  of 
revenue,  and  are  in  the  process  of  becoming  publicly  traded  fit  into  the  other  targeted 
market. 


C.  TARGET  MARKETS 

One  method  ERMS  could  use  to  establish  its  target  markets  is  annual  revenues 
and  position  of  potential  clients  as  discussed  above.  Both  are  examples  of  market 
segmentation  but  were  discussed  in  terms  of  objectives  in  order  to  demonstrate  the 
importance  of  establishing  quantifiable  to  evaluate  or  failure  of  current  programs.  As 
other  methods  of  market  segmentation  are  discussed  in  this  section,  Albert  needs  to  keep 
the  principle  of  quantifiable  objectives  in  mind  and  use  the  examples  discussed  above  to 
develop  ERMS’s  target  market  strategy  in  the  financial  risk  management  market. 

Albert  could  consider  a  differentiation  strategy  as  he  targets  specific  markets. 
While  this  might  also  reduce  the  size  of  his  targeted  market,  it  will  expand  the  revenue 
base  of  potential  customers  and  prove  to  be  more  profitable  in  the  long  run.  I  am 
recommending  a  product  differentiation  strategy.  Throughout  this  analysis,  I  have 
referred  to  ERMS’s  unique  ability  to  execute  financial  controls.  According  to  Albert, 
what  ERMS  does,  that  no  other  company  selling  financial  risk  management  software 
does  is  execute  controls  that  have  been  identified  and  implemented  by  a  company  that 
uses  financial  risk  management  software.  Albert  maintains  that  other  financial  risk 
management  software  only  provides  an  organization  a  place  to  implement  a  control 
which  must  then  be  executed  by  an  actual  person.  However,  ERMS  can  execute  that 
same  control  without  human  assistance.  By  claiming  differentiation  Albert  can  target  the 
entire  market  of  publicly  traded  companies,  regardless  of  revenue,  along  with  start-up 
companies.  Again,  if  Albert  chooses  to  use  differentiation  as  his  method  to  target 
markets  he  must  set  specific  and  quantifiable  goals  that  allow  him  to  evaluate  this  choice 
regularly.  Also,  Albert  should  be  inherently  aware  of  the  potential  threat  posed  by 
substitutes  that  exist  in  this  industry  (discussed  in  the  strategic  analysis  portion  of  this 
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paper)  and  ensure  he  has  taken  extensive  action  to  mitigate  this  threat.  Finally,  at  a 
minimum,  ERMS  should  evaluate  the  success  of  its  marketing  program  semi-annually 
and  adjust  or  abandon  the  selected  method  based  on  prior  planning. 

D.  POSITIONING 

After  detennining  market  segmentation  and  strategy,  Albert  must  next  determine 
the  most  creative  way  to  position  ERMS  within  the  industry.  Regardless  of  whether 
Albert  chooses  to  segment  the  market  based  on  the  revenue  of  potential  clients  or 
ERMS’s  unique  control  execution  capabilities  (differentiation),  he  should  emphasize 
selling  price  as  ERMS’s  position  within  these  markets.  He  can  do  this  because  he  is  able 
to  produce,  install,  and  support  ERMS  at  costs  significantly  lower  then  that  of  his 
competitors.  Therefore,  he  can  set  a  price  point  for  his  product  that  will  position  ERMS 
as  a  price  leader  in  the  market.  The  ability  to  enter  a  market  as  the  least  expensive  and 
highest  quality  product  available  would  definitely  get  ERMS  off  to  a  promising  start. 

E.  STRATEGIES 

To  assist  Albert  as  he  determines  the  best  strategy  to  market  ERMS  it  is  important 
that  the  marketing  strategies  used  are  broken  down  into  specific  areas.  The  specific  areas 
Albert  should  consider  are  product,  pricing,  distribution  and  communication. 

First  Albert  must  detennine  the  most  effective  way  to  demonstrate  to  his  customer 
that  ERMS  is  a  superior  quality  product.  Often  this  is  accomplished  through  unique 
slogans,  memorable  brand  names  and  flashy  advertising  campaigns.  Currently,  ERMS 
uses  an  eye-catching  logo  (grey  and  yellow  Rubik’s  Cube)  set  on  a  background  of  several 
shades  of  grey  with  white  and  yellow  lettering.  The  image  the  consumer  receives  is 
attractive  and  professional  but  fails  to  effectively  demonstrate  the  key  components  of 
ERMS’s  unique  software  capabilities  competitive  pricing  and  differentiation.  In  order  to 
improve  the  overall  quality  of  the  ERMS  brand  and  advertising  message  he  wants  ERMS 
to  portray,  Albert  needs  to  develop  a  plan  to  incorporate  the  words  “cost”  and 
“differentiation”  into  any  material  currently  available  for  public  viewing.  For  example, 
advertising  fliers  currently  in  circulation  need  to  have  some  reference  to  the  low  cost  and 
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unique  software  capabilities  that  complement  the  professional  appearance  of  the  flier. 
Currently,  potential  customers  must  read  the  entire  flier  from  cover  to  cover  to  access 
differentiation  information  but  no  pricing  data  is  available.  In  my  opinion,  ERMS  loses  a 
number  of  potential  customers  because  of  this  despite  the  professional  and  attractive 
design  of  their  fliers. 

Next  Albert  needs  to  focus  on  pricing.  Albert  should  use  the  pricing  suggestions 
discussed  throughout  this  analysis.  As  Albert  researches  industry  competitors  he  should 
continue  to  use  the  current  price  of  $65,000  per  module  and  $5,000  for  installation. 
Based  on  information  provided  by  risk  management  executives  and  personal  research 
these  prices  are  competitive  and  slightly  less  than  those  of  the  competitors  used  for 
research  comparisons  in  this  analysis.  However,  as  Albert  becomes  more  knowledgeable 
on  competitor’s  prices  he  should  attempt  to  significantly  cut  the  prices  he  offers  to 
ERMS’s  customer  base.  This  will  force  his  competitors  to  adapt  accordingly,  leave  the 
industry,  or  allow  ERMS  to  increase  or  totally  control  their  market  share. 

There  has  been  little  discussion  on  the  distribution  techniques  used  by  ERMS  in 
this  analysis  due  to  the  small  size  and  limited  number  of  current  and  potential  customers. 
Hoverer,  as  ERMS  grows  and  the  business  benefits  from  a  successful  marketing 
campaign  an  efficient  distribution  plan  will  be  critical  to  maximizing  revenue  and  overall 
profits.  ERMS  currently  uses  direct  delivery  from  seller  to  buyer  as  their  distribution 
technique,  seller  to  buyer.  However,  ERMS  might  want  to  consider  on-line  and  trade 
shows  as  possible  vehicle  to  both  market  and  distribute  their  product.  The  use  of  the 
internet  as  a  tool  to  distribute  ERMS  software  could  prove  beneficial  to  ERMS  since  it  is 
method  of  financial  risk  management  software  distribution  that  is  relatively  untapped. 
For  example,  Capterra,  a  website  that  helps  buyers  find,  evaluate,  and  select  enterprise 
software  provides  only  five  software  solutions  that  meet  the  following  criteria:  a  purchase 
price  of  greater  than  $1,000,  financial  risk  management  software,  and  regulatory 
compliance  management  capabilities.  With  so  few  options  available  to  potential  buyers  it 
is  clear  that  on-line  distribution  is  a  technique  many  competitors  have  yet  to  utilize. 
Also,  it  presents  an  opportunity  to  market  the  product  concurrently.  ERMS  could  offer 
its  product  through  on-line  vendors  like  Capterra,  or  sell  directly  from  their  website. 
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Another  distribution  technique  ERMS  should  consider  is  risk  management  and 
general  software  trade  shows.  Attendance  at  trade  shows  would  allow  Albert  to  build 
valuable  networks  within  the  industry  of  buyers  and  sellers,  a  tremendous  marketing  tool. 
At  the  same  time,  this  would  allow  Albert  to  take  advantage  of  a  concentration  of 
potential  buyers  that  attend  such  a  function  and  who  all  have  an  identified  interest  in 
financial  risk  management  software.  It  would  also  allow  Albert  to  avoid  the  frustration 
that  often  accompanies  finding  potential  clients.  Finally,  it  would  offer  Albert  the 
opportunity  to  determine  which  of  his  competitors  offer  the  greatest  threat  to  ERMS. 
This  would  allow  Albert  to  compare  ERMS  to  other  financial  risk  management  software 
available  on  the  market  by  viewing  competitor’s  software  and  talking  to  their  software 
representatives.  These  software  representatives  may  be  technicians  whose  knowledge 
and  understanding  of  their  software  is  much  better  than  an  account  executive.  In 
addition,  the  competitor’s  software  being  analyzed  is  likely  to  be  the  entire  product  rather 
than  the  generic  demo  that  is  available  on-line. 

Finally,  Albert  needs  to  evaluate  the  methods  he  will  use  to  communicate 
ERMS’s  availability  and  benefit  to  the  public.  As  previously  discussed,  Albert  is  now 
using  the  internet,  mailers  and  networking  as  his  primary  techniques  for  communicating 
the  availability  of  ERMS  and  its  message.  However,  what  ERMS  has  failed  to  do  is 
evaluate  the  effectiveness  of  any  of  these  mechanisms  and  consider  alternatives  to  those 
methods  that  are  not  productive.  Therefore,  Albert  needs  to  establish  quantifiable 
measurements  of  each  method  discussed  and  then  determine  what  methods  represent 
“value  added”  success.  For  example,  Albert  should  establish  the  number  of  hits  he 
believes  ERMS’s  website  should  receive  daily,  monthly,  and  annually.  After  that,  he 
could  make  an  informed  decision  as  to  whether  the  effort  required  to  maintain  the  website 
and  employ  someone  to  run  the  site  is  beneficial  to  his  business.  If  ERMS’s  website  is 
not  meeting  those  initially  determined  standards,  then  Albert  might  consider  adjustments 
to  improve  the  value  the  website.  Albert  would  also  have  to  evaluate  the  effectiveness  of 
the  mailers.  Mailers  may  have  to  be  eliminated  if  Albert  finds  that  the  value  they  bring  to 
ERMS  is  not  significant. 
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F. 


MARKETING  MIX 


After  determining  the  methods  Albert  believes  will  most  effectively  communicate 
ERMS’s  message  to  consumers,  he  must  next  implement  an  effective  mix  of  those 
methods  that  will  maximize  that  communication  to  as  many  potential  clients  as  possible. 
Albert  s  needs  to  ensure  that  the  methods  he  chooses  are  specific  and  easily  evaluated  in 
order  to  determine  efficiency  as  previously  discussed  in  the  marketing  portion  of  this 
analysis.  One  approach  he  might  use  when  detennining  the  proper  marketing  mix  for  his 
product  is  monthly  individual  tests  of  a  specific  mix  that  can  be  numerically  evaluated 
against  an  entirely  different  mix  the  following  month. 

Some  possible  mixes  of  marketing  campaigns  might  include  running  an 
advertisement  in  a  risk  management  publication  while  at  the  same  time  publishing  an 
article  authored  by  Albert  in  that  same  magazine.  Risk  management  magazines  that 
Albert  might  consider  are  “OpRisk”  and  “Compliance.”  Several  months  later,  Albert 
could  run  the  advertisement  without  the  article  and  see  if  the  responses  he  receives  from 
interested  clientele  are  greater  or  less  when  running  the  add  parallel  to  the  article. 

Another  marketing  mix  Albert  could  attempt  and  evaluate  effectively  is  a  trade- 
show/email/phone  solicitation  campaign.  As  previously  discussed,  trade  shows  are  a 
forum  where  the  congregation  of  potential  buyers  and  sellers  is  optimal.  By  attending  a 
trade  show  and  exchanging  business  cards  with  potential  clients,  Albert  will  have 
established  a  customer  base  with  little  effort.  Next,  he  can  take  those  contacts  and  follow 
up  with  personalized  emails  about  their  encounter  at  the  trade  show  and  include  some 
additional  information  about  the  product  they  discussed  at  the  trade  show.  Finally,  if 
Albert  receives  any  feedback  in  the  form  of  an  email  reply,  he  could  call  the  individuals 
personally,  rather  then  responding  via  email,  and  address  their  questions/concems 
telephonically.  Again,  this  method  could  be  easily  evaluated  and,  accomplished  at 
minimal  cost  to  ERMS. 
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G.  MARKETING  RESEARCH 

Market  research  is  the  final  consideration  Albert  must  implement  in  his  strategic 
marketing  strategy.  Fortunately,  the  analysis  conducted  for  this  case  study  has  provided 
Albert  with  all  the  data  needed  to  complete  the  required  market  research  and  use  it  to 
effectively  assist  in  developing  ERMS’s  marketing  strategy.  A  quick  summary  of  the 
existing  financial  risk  management  market  includes  the  following: 

•  It  is  a  developing  industry  with  few  barriers  to  entry. 

•  If  you  can  price  your  product  significantly  lower  then  your  competitors 
you  hold  a  distinct  advantage  over  them. 

•  Neither  the  supplier  nor  consumer  has  any  significant  power  over  the 
other. 

H.  MANAGEMENT  CONTROLS 

The  controls  that  Albert  chooses  to  monitor  and  evaluate  ERMS’s  marketing 
strategy  have  been  discussed  at  length  throughout  this  analysis.  Marketing  controls  are 
defined  as  the  tools  an  organization  uses  to  ensure  successful  execution  of  their  pre¬ 
determined  marketing  strategy.  Currently,  ERMS  has  no  individual  or  team  in  place  to 
monitor  the  effectiveness  of  their  business’  marketing  strategy.  Therefore,  I  recommend 
that  ERMS  immediately  develop  a  marketing  team  to  implement  and  monitor  some  of  the 
proposals  suggested  in  this  analysis.  I  suggest  that  team  be  started  by  hiring  one 
individual  due  to  current  financial  restrictions.  Once  that  individual  is  hired,  he  or  she 
could  be  augmented  by  individuals  already  employed  by  ERMS  on  an  “as  needed”  basis. 
Although  Albert  might  believe  that  ERMS’s  limited  funds  could  be  better  used  elsewhere 
(i.e.,  leasing  an  office  building)  the  success  of  ERMS  hinges  on  the  company’s  ability  to 
generate  revenue.  Without  an  effective  method  to  generate  sales,  there  will  be  no 
revenue  and  ultimately  no  ERMS. 
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V.  CONCLUSIONS 


The  construction  of  this  case  study  has  been  a  fluid  process.  As  this  case  study 
was  drafted,  I  met  weekly  with  Albert  to  discuss  the  progress  of  the  analysis.  At  the 
conclusion  of  our  meetings,  Albert  would  often  process  the  content  of  our  discussions 
and  implement  or  adjust  ERMS’s  operations  accordingly.  Therefore,  many  of  the 
conclusions  and  recommendations  made  in  this  section  of  the  analysis  are  based  on 
courses  of  action  Albert  and  his  team  at  ERMS  have  already  implemented.  The  way  the 
process  unfolded  was  not  planned;  however,  Albert  and  I  both  benefited  from  this 
evolutionary  process.  By  providing  direction  and  focus  to  Albert  as  the  process  evolved, 
ERMS  was  able  to  move  forward  in  the  development  of  its  business  model  rather  than 
waiting  until  the  completion  of  this  report. 

The  biggest  obstacle  faced  by  ERMS  was  how  the  company  should  move 
forward:  grow  organically  with  no  outside  funding  assistance,  grow  organically  with  the 
assistance  of  outside  funding,  or  seek  a  buyer  to  the  licensing  rights  of  ERMS  Albert  has 
decided  to  concentrate  his  efforts  on  growing  the  company  organically  without  the 
assistance  of  outside  financing  based  on  my  recommendations  and  his  own  beliefs.  He 
has  also  decided  to  pursue  hiring  of  a  CEO.  He  believes  the  experience  of  the  possible 
candidates  will  mitigate  some  of  the  financial  burdens  the  company  will  experience 
without  the  assistance  of  outside  funding.  Along  those  same  lines,  ERMS  should  also 
consider  continuing  to  foster  relationships  with  local  business  schools  as  a  means  of  low- 
cost  expertise  and  management  efficiency. 

The  other  real  challenge  faced  by  ERMS  is  how  to  penetrate  the  financial  risk 
management  market  and  be  considered  a  legitimate  competitor  within  the  selected 
market.  Several  recommendations  were  made  in  the  body  of  this  analysis.  I  recommend 
that  ERMS  pursue  a  revenue-directed  strategy  primarily  focused  on  the  low-level 
consumer  considering  ERMS’s  current  business  plan,  the  opportunities  that  exist  in  the 
low  to  middle  market  financial  risk  management  industry,  and  ERMS’s  decided 
advantage  with  respect  to  production  and  support  cost. 
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Another  hurdle  that  ERMS  must  overcome  when  pursuing  customers  is  quality  if 
low-level  consumers  do  not  consider  price  an  issue.  To  overcome  this  obstacle,  I 
recommend  that  Albert  hire  an  analyst  to  develop  a  model  that  demonstrates  how 
ERMS’s  control  execution  capabilities  will  bring  value  in  terms  of  financial  saving  to 
prospective  customers.  It  would  be  extremely  difficult  for  customers  to  say  no  if  Albert 
is  able  to  demonstrate  significant  savings  coupled  with  a  low  purchase  price. 

Finally,  here  are  some  ideas  Albert  should  consider  regardless  of  the  direction  he 
chooses  for  ERMS.  First,  he  should  participate  in  financial  risk  management 
conferences.  They  are  held  regularly  and  access  to  them  can  be  gained  by  getting  on  an 
email  list  such  as  Approva’s  (easily  done  by  requesting  more  information  on  their 
company  via  the  company  website).  Albert  will  receive  notification  as  to  the  time  and 
place  of  many  of  these  conferences.  Next,  he  should  attend  software  trade  shows  with 
regularity.  Based  on  ERMS’s  current  location,  Albert  should  use  access  to  Silicon  Valley 
to  his  benefit.  Finally,  Albert  should  take  advantage  of  any  opportunities  provided  by  the 
Small  Business  Association  (SBA).  For  example,  the  Department  of  Defense  provides 
opportunities  for  small  businesses,  through  the  SBA,  to  provide  the  government  with 
cutting-edge  technology  if  it  meets  their  specification  and  requirements. 

There  is  no  question  that  the  financial  risk  management  industry  is  lined  with 
opportunities.  It  is  also  evident  that  ERMS  is  a  tool  that  can  provide  institutions 
struggling  to  manage  financial  risk  a  low-cost,  reliable  tool  to  combat  that  risk.  At  this 
point,  Albert  should  continue  to  build  on  the  findings  and  recommendations  in  this 
analysis  and  move  to  the  future  with  the  comfort  of  knowing  the  goals  he  has  established 
for  his  company  are  achievable. 
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